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Dear Attorney General Herring: 

Pursuant to Section 18.2-186.6 of the Code of Virginia, we are writing to notify you that one (1) 
participant of the Akerman, LLP ("Akerman") self-insured group health plan who is a Virginia 
resident was affected as a result of the Anthem data breach that was publicly disclosed in early 
February 2015. 

According to Anthem, on January 29, 2015, it discovered that it was the victim of a 
"sophisticated external cyber-attack." Anthem says it believes the cyber-attack occurred over 
several weeks beginning in early December 2014. Anthem also says that the cyber-attackers 
gained unauthorized access to Anthem's data warehouse and, as a result, obtained personal 
information of its members. This information may have included names, street addresses, email 
addressee, telephone numbers, and in some circumstances, social security numbers. 

According to Anthem, it immediately reported the attack to the FBI and is cooperating with the 
FBI's investigation. Anthem also states that it has retained a leading cybersecurity firm to assist 
them with the investigation and to strengthen the security of its systems. Anthem reports that it 
has no evidence that the cyber-attackers were able to obtain any medical, banking or credit card 
information. Nonetheless, in an abundance of caution. Anthem has, at its expense, arranged for 
credit monitoring and alert services for the affected employees through AllClear ID 
( www.allclearid.com ). 

When Anthem publicly disclosed the cyber-attack on February 4, 2015, Blue Cross Blue Shield 
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of Florida (BCBSF), the third-party administrator of the Akerman self-insured group health plan, 
notified Akerman of the cyber-attack, but at that time it was unknown whether any Akerman 
BCBSF participants' information was involved in the data breach. On March 11, 2015, BCBSF 
confirmed to Akerman that some plan participants were affected by the breach and provided the 
firm the names of the affected individuals. 

Akerman is not at fault or in any way responsible for Anthem's data breach. That said, as plan 
sponsor of the group health plan, Akerman wishes to independently comply with all disclosure 
and reporting obligations under applicable law. As mentioned above, one (1) of the individuals 
affected by this data breach resides in Virginia, and this individual will be, concurrent with the 
sending of this letter to you, notified via U.S. Mail at their current home address pursuant to § 
18.2-186.6A, Code of Virginia. Enclosed for your files is a copy of the notice template that is 
being distributed to all potentially affected individuals. The notice encourages individuals to 
sign up for the 2 years' free credit-monitoring that Anthem is offering. 

Akerman, LLP is simultaneously sending notice to any other state governments that require such 
reporting. If you have any further questions or need additional information, please contact me at 
(407) 254-3594. 


Sincerely, 



Patti L. Greber 

Director of Human Resources 
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Re: Recent Anthem Breach and its Impact to You 


Dear 

As you may be aware from recent news reports, in early February 2015, a large health insurance 
company, Anthem, Inc., disclosed that it had been the victim of a sophisticated external cyber¬ 
attack. Wc are writing to inform you that Anthem has determined that you are one of the 
individuals whose personal information was improperly accessed as a result of the cyber-atta ck. 

At the time that Blue Cross Blue Shield of Florida (BCBSF) first notified Akerman of the cyber¬ 
attack on Anthem in early February 2015, it was unknown if any Akerman BCBSF participants' 
information was involved in the data breach. However, on March 11, 2015, BCBSF confirmed 
that some Akerman BCBSF participants were affected by the breach and provided us the names 
of individuals who Anthem initially determined to be impacted BCBSF members. Regrettably, 
your name was included on the list we received. 

Anthem reported that the cyber-attackers gained unauthorized access to its data warehouse and, as 
a result, obtained certain personal information of its members. According to Anthem, this 
information may have included names, street addresses, email addresses, telephone numbers, 
dales of birth, member identification numbers, income data and social security numbers. At this 
point, Anthem reports that it has no evidence that the cyber-attackers were able to obtain any 
medical, banking or credit card information. 

As soon as our firm was made aware of the cyber-attack and the potential impact it could have on 
Akerman BCBSF participants, we immediately began working very closely with BCBSF to 
monitor the situation in order to provide updates to our employees as soon as information was 
available. We remain in close communication with BCBSF and will continue to monitor, assess 
and report any new findings, as needed. 

According to Anthem, the attack was immediately reported to the FBI and Anthem is cooperating 
with the FBI's investigation. Anthem also slates that they have retained a leading cybersecurity 
firm to assist them with the investigation and to strengthen the security of their systems. 

You may wonder w'hy a breach at Anthem impacts you, since your plan is administered by 
BCBSF, not Anthem. The impact of this cyber-attack extends beyond Anthem's members 
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health care services covered under the BlucCard program. As you may know, the BlueC’ard 
program enables members of one Blue Cross and Blue Shield Plan to obtain coverage for health 
care services while traveling or living in another Blue Cross and Blue Shield Plan's service area. 
BCBSF members who received BlueCard-covered health care services that were administered by 
Anthem (i.e., had their health insurance claims processed by an Anthem affiliated Plan) over the 
past ten years were potentially impacted by this cyber-attack. Separately, we have also been 
advised by BCBSF that members who have had medical testing or lab work performed in one 
state and sent to a facility in another state covered by Anthem could also be impacted. For 
example, you may have had blood drawn in Florida, but the sample happened to have been sent 
to California for processing. Anthem operates affiliated plans in 14 states - California, Colorado, 
Connecticut, Georgia, Indiana, Kentucky, Maine, Missouri, Nevada, New Hampshire, New York, 
Ohio, Virginia, and Wisconsin. 

As a result of this breach affecting your information, we encourage you to take the following 
precautionary measures to protect your credit and identity: 

Free Credit Monitoring and Repair - Anthem is offering two years of credit monitoring and 
identity theft repair services at no cost to impacted or potentially impacted members. You may 
enroll in these services or obtain additional information concerning the Anthem data breach 
online at www.AnthemFacts.com or by calling 1-877-263-7995. 

Free Credit Reports - To find out more about protecting your identity, you can contact the 
Federal Trade Commission: (1) toll free at 877-438-4338; (2) online at 
www.consumer.gov/idthefl ; or (3) in writing at The Federal Trade Commission, 600 
Pennsylvania Avenue NW, Washington, DC 20580. The Federal Trade Commission has 
counselors who can tell you how to contact the credit bureaus to get a free credit report or to 
freeze your credit. 


Here is contact information for three major consumer reporting agencies: 


Equifax 

Experian 

TransEnion 

PO BOX 740241 

PO BOX 9532 

PO BOX 2000 

ATLANTA, GA 30374-0241 

ALLEN, TX 75013 

CHESTER, PA 19022 

1-800-685-11li_ 

. 1-888-357-3742 

.1-800-916-8800 

equifax.com 

experian.com 

transunion.com 


North Carolina residents may obtain information from the North Carolina Office of the Attorney 
General at: http://www.ncdoi.gov7C rime.aspx. call 1-919-716-6400, or write to this address: 

Attorney General's Office 

9001 Mail Service Center 
Raleigh, NC 27699-9001 
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Prevent Unauthorized Access to Your Accounts - Review your account statements and monitor 
free credit reports. Contact your financial institutions to prevent unauthorized access to personal 
accounts. 

Be Aware of Scams Anthem has stated that they are not calling members regarding the cyber¬ 
attack and are not asking for credit card information or Social Security numbers over the phone. 
There are also email scams designed to capture personal information and are designed to look as if 
they are being sent from Anthem, For more information on recognizing scam email, visit the FTS 
website: http://www.consumer.ftc.izov/aiticles/0Q03-phishini2 . 

You may have also received similar notification letters from BCBSF and/or Anthem. If you have 
not, you should expect to receive their notification letters in the coming days or weeks. In 
addition, it is possible that you or a family member could receive a separate notification from 
Anthem (or another Blue Cross entity) because your data from a non-Akerman Blue Cross plan 
may have been compromised. 

We are sorry for the inconvenience the Anthem data breach has caused. We at Akerman continue 
our commitment to safeguarding personal data from unauthorized access. 

If you have any questions or concerns, please feel free to contact Blair Stum at (407) 254-3460 or 
blair.stum@akerman.com . or me at (407) 254-3594 or pait i.greher@akerman.com . 

Sincerely, 


Patti L. Greber 

Director of Human Resources 
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